Oracle Cost Management CVE-2026-60744

A low-privilege Oracle E-Business Suite account (PR:L) is required - unauthenticated exploitation is ruled out by the CVSS vector. Network access via HTTP to the Oracle EBS application server is required (AV:N). The high attack complexity (AC:H) indicates exploitation is non-trivial: Oracle's own description characterizes it as 'difficult to exploit,' implying specific preconditions such as knowledge of internal endpoint paths, server-side state, or a non-default request pattern - though Oracle has not publicly disclosed the exact complexity factor. No victim user interaction is required (UI:N). Exploitation is limited by: (1) the requirement for a pre-existing low-privilege EBS account, excluding purely external attackers without any foothold; (2) AC:H complexity, which prevents automated or spray-style exploitation; and (3) unchanged scope (S:U), meaning impact is contained to Oracle Cost Management data rather than broader OS or host compromise.

The CVSS 3.1 score of 6.8 reflects a materially constrained risk profile driven primarily by AC:H ('difficult to exploit'), which substantially reduces the probability of opportunistic or automated exploitation. PR:L confirms that some authenticated foothold within Oracle EBS is a prerequisite, further narrowing the realistic attacker population to insiders, compromised accounts, or attackers who have already achieved initial access. Despite these constraints, the C:H/I:H impact metrics indicate that successful exploitation yields complete read and write access to Oracle Cost Management data - a high-consequence outcome for organizations managing financial ledgers, standard costs, and cost rollups in EBS. EPSS data was not available in the provided intelligence, so quantitative exploitation probability cannot be cited. The vulnerability is not listed in the CISA KEV catalog, and no public POC code has been identified, consistent with the AC:H vector. For most organizations, this sits in a watch-and-patch posture rather than emergency response, unless the environment hosts highly sensitive cost data or the low-privilege account barrier is easily cleared by a large internal user population.

An attacker holding a low-privilege Oracle EBS account - such as a read-only analyst, shared reporting credential, or compromised service account - sends a specially crafted HTTP request to the Internal Operations component that circumvents the authorization check. Upon bypass, the attacker gains read access to all Oracle Cost Management data (cost rollups, standard costs, financial records) and write access to create, modify, or delete those records. No public POC is known; the AC:H rating suggests the attacker likely needs specific knowledge of the targeted endpoint or application state to succeed.